cve,link,title,description,vendor,products,score,severity,epss,cisa,article,ransomware,exploited,poc,trended,trended_no_1,published,trended_score
CVE-2022-27488,https://securityvulnerability.io/vulnerability/CVE-2022-27488,CSRF Vulnerability in Fortinet FortiVoice and Related Products,"A cross-site request forgery vulnerability exists within multiple Fortinet products, including FortiVoiceEnterprise, FortiSwitch, and FortiMail. This vulnerability allows remote unauthenticated attackers to execute arbitrary commands on the command-line interface. The exploit relies on tricking authenticated administrators into sending malicious GET requests, potentially compromising sensitive administrative functions.",Fortinet,"Fortivoice,Fortirecorder,Fortiswitch,Fortindr,Fortimail",7.5,HIGH,0.000699999975040555,false,false,false,false,,false,false,2023-12-13T07:15:00.000Z,0
CVE-2023-45582,https://securityvulnerability.io/vulnerability/CVE-2023-45582,,"An improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiMail webmail version 7.2.0 through 7.2.4, 7.0.0 through 7.0.6 and before 6.4.8 may allow an unauthenticated attacker to  perform a brute force attack on the affected endpoints via repeated login attempts.",Fortinet,Fortimail,5.3,MEDIUM,0.0007600000244565308,false,false,false,false,,false,false,2023-11-14T18:15:00.000Z,0
CVE-2023-36633,https://securityvulnerability.io/vulnerability/CVE-2023-36633,,An improper authorization vulnerability [CWE-285] in FortiMail webmail version 7.2.0 through 7.2.2 and before 7.0.5 allows an authenticated attacker to see and modify the title of address book folders of other users via crafted HTTP or HTTPs requests.,Fortinet,Fortimail,5.3,MEDIUM,0.0005200000014156103,false,false,false,false,,false,false,2023-11-14T18:15:00.000Z,0
CVE-2023-36637,https://securityvulnerability.io/vulnerability/CVE-2023-36637,,An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiMail version 7.2.0 through 7.2.2 and before 7.0.5 allows an authenticated attacker to inject HTML tags in FortiMail's calendar via input fields.,Fortinet,Fortimail,3.4,LOW,0.0005300000193528831,false,false,false,false,,false,false,2023-10-10T17:15:00.000Z,0
CVE-2023-36556,https://securityvulnerability.io/vulnerability/CVE-2023-36556,Authorization Exploit in FortiMail Webmail by Fortinet,"An incorrect authorization vulnerability in FortiMail webmail allows authenticated attackers to gain unauthorized access to other users' accounts on the same web domain. This can be exploited through specially crafted HTTP or HTTPS requests, compromising user data and potentially leading to further attacks within the network. Various versions, including 7.2.0 to 7.2.2, as well as earlier versions below 6.4.7, are susceptible to this flaw.",Fortinet,Fortimail,8.6,HIGH,0.0008900000248104334,false,false,false,false,,false,false,2023-10-10T17:15:00.000Z,0
CVE-2022-29056,https://securityvulnerability.io/vulnerability/CVE-2022-29056,,"A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiMail version 6.4.0, version 6.2.0 through 6.2.4 and before 6.0.9 allows  a remote unauthenticated attacker to partially exhaust CPU and memory via sending numerous HTTP requests to the login form.",Fortinet,Fortimail,3.5,LOW,0.0014299999456852674,false,false,false,false,,false,false,2023-03-09T14:54:52.009Z,0
CVE-2022-39945,https://securityvulnerability.io/vulnerability/CVE-2022-39945,,"An improper access control vulnerability [CWE-284] in FortiMail 7.2.0, 7.0.0 through 7.0.3, 6.4 all versions, 6.2 all versions, 6.0 all versions may allow an authenticated admin user assigned to a specific domain to access and modify other domains information via insecure direct object references (IDOR).",Fortinet,Fortinet Fortimail,5.4,MEDIUM,0.0006500000017695129,false,false,false,false,,false,false,2022-11-02T00:00:00.000Z,0
CVE-2022-26122,https://securityvulnerability.io/vulnerability/CVE-2022-26122,,"An insufficient verification of data authenticity vulnerability [CWE-345] in FortiClient, FortiMail and FortiOS AV engines version 6.2.168 and below and version 6.4.274 and below may allow an attacker to bypass the AV engine via manipulating MIME attachment with junk and pad characters in base64.",Fortinet,"Fortinet Av Engine, Fortimail, FortiOS, Forticlient",4.7,MEDIUM,0.0007300000288523734,false,false,false,false,,false,false,2022-11-02T00:00:00.000Z,0
CVE-2022-26114,https://securityvulnerability.io/vulnerability/CVE-2022-26114,,An improper neutralization of input during web page generation vulnerability [CWE-79] in the Webmail of FortiMail before 7.2.0 may allow an unauthenticated attacker to trigger a cross-site scripting (XSS) attack via sending specially crafted mail messages.,Fortinet,Fortinet Fortimail,5.4,MEDIUM,0.0007699999841861427,false,false,false,false,,false,false,2022-09-06T15:15:12.000Z,0
CVE-2022-22299,https://securityvulnerability.io/vulnerability/CVE-2022-22299,,"A format string vulnerability [CWE-134] in the command line interpreter of FortiADC version 6.0.0 through 6.0.4, FortiADC version 6.1.0 through 6.1.5, FortiADC version 6.2.0 through 6.2.1, FortiProxy version 1.0.0 through 1.0.7, FortiProxy version 1.1.0 through 1.1.6, FortiProxy version 1.2.0 through 1.2.13, FortiProxy version 2.0.0 through 2.0.7, FortiProxy version 7.0.0 through 7.0.1, FortiOS version 6.0.0 through 6.0.14, FortiOS version 6.2.0 through 6.2.10, FortiOS version 6.4.0 through 6.4.8, FortiOS version 7.0.0 through 7.0.2, FortiMail version 6.4.0 through 6.4.5, FortiMail version 7.0.0 through 7.0.2 may allow an authenticated user to execute unauthorized code or commands via specially crafted command arguments.",Fortinet,"Fortinet Fortiadc, Fortiproxy, Fortimail, FortiOS",7.8,HIGH,0.0004400000034365803,false,false,false,false,,false,false,2022-08-05T15:23:52.000Z,0
CVE-2021-32586,https://securityvulnerability.io/vulnerability/CVE-2021-32586,,An improper input validation vulnerability in the web server CGI facilities of FortiMail before 7.0.1 may allow an unauthenticated attacker to alter the environment of the underlying script interpreter via specifically crafted HTTP requests.,Fortinet,Fortinet Fortimail,7.7,HIGH,0.001769999973475933,false,false,false,false,,false,false,2022-03-01T18:20:10.000Z,0
CVE-2021-36166,https://securityvulnerability.io/vulnerability/CVE-2021-36166,,An improper authentication vulnerability in FortiMail before 7.0.1 may allow a remote attacker to efficiently guess one administrative account's authentication token by means of the observation of certain system's properties.,Fortinet,Fortinet Fortimail,9.8,CRITICAL,0.0042500002309679985,false,false,false,false,,false,false,2022-03-01T18:10:10.000Z,0
CVE-2021-43062,https://securityvulnerability.io/vulnerability/CVE-2021-43062,,"A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiMail version 7.0.1 and 7.0.0, version 6.4.5 and below, version 6.3.7 and below, version 6.0.11 and below allows attacker to execute unauthorized code or commands via crafted HTTP GET requests to the FortiGuard URI protection service.",Fortinet,Fortinet Fortimail,6.1,MEDIUM,0.00215999991632998,false,false,false,false,,false,false,2022-02-02T11:08:07.000Z,0
CVE-2020-15933,https://securityvulnerability.io/vulnerability/CVE-2020-15933,,"A exposure of sensitive information to an unauthorized actor in Fortinet FortiMail versions 6.0.9 and below, FortiMail versions 6.2.4 and below FortiMail versions 6.4.1 and 6.4.0 allows attacker to obtain potentially sensitive software-version information via client-side resources inspection.",Fortinet,Fortinet Fortimail,5.3,MEDIUM,0.0008399999933317304,false,false,false,false,,false,false,2022-01-05T11:29:04.000Z,0
CVE-2021-26095,https://securityvulnerability.io/vulnerability/CVE-2021-26095,,"The combination of various cryptographic issues in the session management of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6, including the encryption construction of the session cookie, may allow a remote attacker already in possession of a cookie to possibly reveal and alter or forge its content, thereby escalating privileges.",Fortinet,Fortinet Fortimail,7.5,HIGH,0.0031399999279528856,false,false,false,false,,false,false,2021-07-20T10:48:06.000Z,0
CVE-2021-24013,https://securityvulnerability.io/vulnerability/CVE-2021-24013,,Multiple Path traversal vulnerabilities in the Webmail of FortiMail before 6.4.4 may allow a regular user to obtain unauthorized access to files and data via specifically crafted web requests.,Fortinet,Fortinet Fortimail,8.8,HIGH,0.0009299999801442027,false,false,false,false,,false,false,2021-07-12T13:30:55.000Z,0
CVE-2021-24015,https://securityvulnerability.io/vulnerability/CVE-2021-24015,,An improper neutralization of special elements used in an OS Command vulnerability in the administrative interface of FortiMail before 6.4.4 may allow an authenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.,Fortinet,Fortinet Fortimail,7.2,HIGH,0.0016799999866634607,false,false,false,false,,false,false,2021-07-12T13:25:53.000Z,0
CVE-2021-26090,https://securityvulnerability.io/vulnerability/CVE-2021-26090,,A missing release of memory after its effective lifetime vulnerability in the Webmail of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6 may allow an unauthenticated remote attacker to exhaust available memory via specifically crafted login requests.,Fortinet,Fortinet Fortimail,5.3,MEDIUM,0.0017900000093504786,false,false,false,false,,false,false,2021-07-12T12:53:27.000Z,0
CVE-2021-26099,https://securityvulnerability.io/vulnerability/CVE-2021-26099,,Missing cryptographic steps in the Identity-Based Encryption service of FortiMail before 7.0.0 may allow an attacker who comes in possession of the encrypted master keys to compromise their confidentiality by observing a few invariant properties of the ciphertext.,Fortinet,Fortinet Fortimail,4.4,MEDIUM,0.0006000000284984708,false,false,false,false,,false,false,2021-07-12T09:56:37.000Z,0
CVE-2021-24007,https://securityvulnerability.io/vulnerability/CVE-2021-24007,,Multiple improper neutralization of special elements of SQL commands vulnerabilities in FortiMail before 6.4.4 may allow a non-authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.,Fortinet,Fortinet Fortimail,9.8,CRITICAL,0.0035600000992417336,false,false,false,false,,false,false,2021-07-09T18:37:57.000Z,0
CVE-2021-22129,https://securityvulnerability.io/vulnerability/CVE-2021-22129,,Multiple instances of incorrect calculation of buffer size in the Webmail and Administrative interface of FortiMail before 6.4.5 may allow an authenticated attacker with regular webmail access to trigger a buffer overflow and to possibly execute unauthorized code or commands via specifically crafted HTTP requests.,Fortinet,Fortinet Fortimail,8.8,HIGH,0.0009599999757483602,false,false,false,false,,false,false,2021-07-09T18:26:30.000Z,0
CVE-2021-26100,https://securityvulnerability.io/vulnerability/CVE-2021-26100,,A missing cryptographic step in the Identity-Based Encryption service of FortiMail before 7.0.0 may allow an unauthenticated attacker who intercepts the encrypted messages to manipulate them in such a way that makes the tampering and the recovery of the plaintexts possible.,Fortinet,Fortinet Fortimail,5.9,MEDIUM,0.001069999998435378,false,false,false,false,,false,false,2021-07-09T18:23:01.000Z,0
CVE-2021-24020,https://securityvulnerability.io/vulnerability/CVE-2021-24020,,"A missing cryptographic step in the implementation of the hash digest algorithm in FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 may allow an unauthenticated attacker to tamper with signed URLs by appending further data which allows bypass of signature verification.",Fortinet,Fortinet Fortimail,7.5,HIGH,0.0030799999367445707,false,false,false,false,,false,false,2021-07-09T18:17:26.000Z,0
CVE-2020-9294,https://securityvulnerability.io/vulnerability/CVE-2020-9294,,"An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 and 6.0.1 may allow a remote unauthenticated attacker to access the system as a legitimate user by requesting a password change via the user interface.",Fortinet,"Fortimail,Fortivoiceenterprise",9.8,CRITICAL,0.024609999731183052,false,false,false,false,,false,false,2020-04-27T17:15:00.000Z,0
CVE-2019-15707,https://securityvulnerability.io/vulnerability/CVE-2019-15707,,"An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to perform system backup config download they should not be authorized for.",Fortinet,Fortinet Fortimail,4.9,MEDIUM,0.0006500000017695129,false,false,false,false,,false,false,2020-01-23T17:47:00.000Z,0